The Sub-10-Microsecond Command Boundary

Every safety-critical actuation on both machines must complete inside a 10-microsecond deterministic window, from validated command to physical gate.

The hard boundary

Kronos fixes a design contract: any command on a protection or fast-stability path completes within 10 µs of the triggering condition, worst case, including jitter. This is not an average; it is a bound the fabric must satisfy on its slowest cycle. The number is chosen to sit below the fastest physically relevant instability growth times the control system is asked to arrest.

Why 10 microseconds

On the breeder, vertical displacement events (VDEs) of an elongated, negative-triangularity plasma grow on millisecond timescales, but the ideal MHD and current-quench precursors that must be sensed and acted on impose sub-millisecond sampling. Reserving a 10 µs actuation floor leaves ample margin against the fastest loop while keeping the timing budget provable. On the burner, DEC grid transients and end-plug microstability demand comparably tight response on the collector modulation path.

Budget decomposition

The 10 µs is not spent in one place. A representative allocation on the fast protection path:

• Analog acquisition + anti-alias settle: ~1.5 µs
• Signal validation + spatial normalization in fabric: ~2 µs
• Decision logic (threshold / voting): ~1 µs
• Deterministic link to actuator driver: ~2 µs
• Gate propagation + driver turn-on: ~2 µs
• Margin reserve: ~1.5 µs

Because each term has a proven worst-case execution time (WCET), the sum is a certified bound rather than a hopeful mean. Any path that cannot be bounded is not permitted to carry a protection function.

What lives outside the boundary

Model inference, trajectory optimization, and anything with data-dependent runtime lives at L3 and is treated as advisory. The boundary is the firewall: L1 will always act within 10 µs using deterministic logic even if every upstream model is unavailable. See determinism vs learning.